Auditing Logs on a large-scale

[Luis]

Hello there,

I want to do some research on CT logs for my bachelor thesis. Namely, I want to verify the integrity of SCTs with their corresponding entry in the logs (general existence and temporal).
My goal is to verify for a large dataset of certificates that each of the certificates is properly included.

I now have some problems that I ran into while researching and doing some coding myself.

1. Since the timestamp used in the leaf_hash of the entries can be in a relatively large range ((timestamp given in the SCT) to (timestamp given in the SCT + MMD)), I am thinking about how to efficiently query the logs to get the correct entry. Is there maybe already an implementation of this? So that I just have to give the implementation the certificate and the timestamp of the SCT and it will find me the exact entry?
2. If there is no known implementation so far: I was thinking about doing a binary search on the rough timestamp - given by the SCT - in the CT log, so that I have a starting point. From there, I try to do a linear search to find the entry that contains the certificate I am looking for. Is this feasible, or is there a smarter way to do this?
3. As an alternative, is there any monitor, that is allowing automated high-frequency access for research purposes?

Thanks in advance! Love the project

Best regards.

[Matthew McPherrin]

If you have a certificate that you want to check is included in a log, you should use `get-proof-by-hash`

https://datatracker.ietf.org/doc/html/rfc6962#section-4.5

That will return the leaf_index telling you where a certificate is in the tree, along with the audit_path needed to validate the certificate is included in the tree.

--
You received this message because you are subscribed to the Google Groups "certificate-transparency" group.
To unsubscribe from this group and stop receiving emails from it, send an email to certificate-transp...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/certificate-transparency/0facadd9-bd38-4af1-844a-415e54ee4ed5n%40googlegroups.com.

[Filippo Valsorda]

Hi Luis,

If I understand correctly, you have a certificate and an SCT, and want to get the corresponding log entry. That's what /ct/v1/get-proof-by-hash is for. (In a Static CT API log, you'd use the SCT extension, instead.)

Note that the TimestampedEntry.timestamp which is part of the leaf hash is the same timestamp as in the SCT, not the timestamp of when the leaf was merged into the log.

Cheers,

Filippo

[Luis]

Thank you for the clarification!

My code accidentally used another timezone than UTC, I did not realize, that the SCT timestamp and the TimestampedEntry.timestamp were the same.

But then, how can I confirm that the certificate was included in a timely manner (before the Maximum Merge Delay)?

Is it even possible to get the time when the leaf was merged into the log after a long time?

Best regards.

[Kurt Roeckx]

Hi,

You can check the first STH that included the entry for the certificate.

Kurt